Almost everything we know about you, you told us in an email or on the phone. The website itself still collects nothing for us — a consent manager remembers your cookie choice, and an optional chat widget loads only if you ask for it. This policy covers the little we collect, why we hold it, how long we keep it, and how to get it back or get it deleted.
Gearhold LLC is a Wyoming limited liability company. Our operational and customer-service address is 104 S Cherry St, Tunnel Hill, GA 30755, USA. We sew fixed-gear pedal straps by hand and sell them at fixedgearstraps.com. Where this policy says we or us, that is who it means.
Two things are covered here. The website, and the business behind it — the inbox we answer, the phone we pick up Tue–Sat 10–18 ET, the orders we pack, the quotes we write and the straps that come back for a restitch. Nearly everything we hold came from the second list, because the website itself collects next to nothing — 2.0 is the precise version of that sentence.
Under EU and UK data protection law we are the controller of the personal data described here. We have not appointed a Data Protection Officer and we have not appointed an EU or UK representative. We are one bench, the processing below is occasional and low risk, and we would rather say that plainly than imply a compliance department that does not exist.
The sibling documents pick up where this one stops: /legal/cookies for the cookie inventory, /legal/trust-security for how we look after what we hold, /legal/your-data for the step-by-step on making a request, and /legal/terms for what you are actually buying.
Almost nothing, and nothing at all for us. The site is a set of statically rendered pages with no accounts, no login, no cart, no checkout and no newsletter signup, so there is nothing to sign into and nothing to sign up for. Our own code sets no cookies and writes nothing to local storage, session storage or any browser database.
The list of what is absent is longer than the list of what is present, so here it is in full.
Two third-party tools do run on the page, and pretending otherwise would make the rest of this policy worthless. The first is Termly, the consent manager behind the banner on your first visit and the Cookie Settings button in the footer of every page. It stores your cookie choice in your browser and reports it to Termly’s consent service, so the banner does not re-ask on every page and there is a record of what you answered. That is the one strictly necessary storage write on the site.
The second is tawk.to, the live-chat widget. It is optional, and the consent manager blocks it — no script, no connection, no storage — until you opt in to its category in the banner or in Cookie Settings. If you switch it on, the widget can begin a visitor session even if you never send a message. While it is active, tawk.to processes your chat messages and any name, email or other details you submit in the chat; your IP address and browser or device data; the pages you view and your session activity; your approximate location; and timestamps. The purposes are delivering the live chat, monitoring and troubleshooting chat sessions, security, support and follow-up, and the recipient is tawk.to and its subprocessors.
If you never opt in, none of that happens. If you do use the chat, one rule: do not put card numbers, account credentials or anything highly sensitive into the chat window. No card field exists anywhere on this site, and nothing legitimate will ever ask you for one in the chat.
Pages still have to be served by somebody. Our hosting provider runs the machines that answer your browser, and like every web server theirs will process connection data — IP address, the file requested, a timestamp, your user-agent — to deliver the page and keep the service standing up. That is ordinary infrastructure, not a Gearhold decision. Those logs belong to the host and sit outside anything we built. We do not pull them into reports, we run no analytics on them, and no part of this site reads them.
The 3D cog on the home page runs on three.js, which is bundled into the site itself rather than pulled from a CDN. It spins and it reports nothing.
The wholesale quote form at /quote never leaves your browser. It checks the fields, works out an estimate in JavaScript running on your own machine, generates a reference number shaped GH-Q-XXXX-### and prints a summary panel on the page. It transmits nothing. It stores nothing. Close the tab and the entry is gone — no draft, no autosave, nothing sitting on a server waiting for us to read it.
The fields it shows are your full name, email, company or shop name, buyer type (bike shop, team or club, courier fleet, event or race, or other), the products you want, quantity in pairs, colorways, timeline and a free-text notes field. None of it reaches us unless you copy it into an email yourself.
To actually reach a person with a quote request, email quotes@fixedgearstraps.com or call +1 (762) 760-1179. From that moment section 5.0 applies, and we hold what you sent the same way we hold any other message.
In plain EnglishLoading the typefaces sends your IP address to Google in the United States and to a type foundry in India. It is the only third-party request the page makes on its own account, and unlike the request for the page itself, you can block it.
The site loads three typefaces from two providers: Archivo and Space Mono from Google Fonts, at fonts.googleapis.com and fonts.gstatic.com, and Clash Display from Fontshare, at api.fontshare.com. Apart from the consent manager and the opt-in chat widget in 2.0, these are the only third-party network requests the site makes.
A font request is still a request. When your browser fetches those files it hands the provider your IP address, your user-agent string and the page you were on when it asked. Google Fonts is operated by Google LLC in the United States. Fontshare is operated by Indian Type Foundry in India. If you are reading this from the EEA or the UK, that is personal data leaving your country for the United States and for India.
On safeguards, the honest answer: we have no contract with either provider, no standard contractual clauses of our own covering these requests, and no transfer impact assessment on file. We rely on the terms each provider publishes for its font service. If that is not good enough for you, the fix is to stop the request rather than to take our word for it.
Neither request sets a cookie on this site and nothing is written into your browser. That does not make the IP transfer disappear, which is why it is written down here rather than left out.
You can block it. Turn off third-party font loading in your browser settings, or use a content blocker or extension that blocks fonts.googleapis.com, fonts.gstatic.com and api.fontshare.com. The page falls back to the typefaces already on your machine. It looks blunter. Every word still reads.
Everything we hold, you handed over. An email, a phone call, a chat message, a note folded into a parcel. There is no other source.
| What we hold | How we got it |
|---|---|
| Name | You wrote it in an email or said it on the phone |
| Email address | The address you wrote from, or one you gave us for tracking |
| Postal address | You gave it so a parcel could find you |
| Phone number | Only if you offered one. We do not require it |
| What you ordered | The order itself — products, lengths, colorways, quantity, price |
| Shop or team name, and buyer type | Wholesale enquiries and quotes: bike shop, team or club, courier fleet, event or race, or other |
| Whatever you put in a message | You typed it or said it. Free text is free — we end up holding what you chose to write |
| Whatever you put in a chat | Only if you switched the chat widget on first — the transcript sits with tawk.to as well as in front of us |
| Guarantee and repair notes | What came back, what failed, what Ruth did about it, where it went afterwards |
Ruth is the 1978 bar-tack machine, not a person, in case that row read oddly.
We do not ask for a date of birth, a government ID number, banking credentials, health information, or anything about your race, religion, politics, union membership, sex life or sexual orientation. We have no use for any of it. If a message turns up with something like that in it, we do not act on it and we take it out of the record when we notice. Keep out of an email anything you would not want sitting in an inbox.
We buy no lists. We do not enrich what you gave us with data bought from anywhere else, and we build no profile on you. There is nowhere to build one and no reason to want it.
Do you have to give us any of it? Only what the job needs. A name and a delivery address, or the parcel has nowhere to go. An email address or a phone number, or we cannot answer you. Withhold those and we cannot take the order — not a penalty, just the arithmetic of posting something to somebody. Everything else is optional: a phone number when you have already given an email, a shop name, the notes field. Leave them blank and the order still works. The only part the law itself requires is what ends up on the invoice for tax.
No payment happens on this website. There is no cart and no checkout. The arrowed links on the product cards take you to the quote form and do nothing else. No card number is ever typed into fixedgearstraps.com — not into a form, and the chat is no place for one either.
Orders are placed and paid off the website, by email or by phone. When you pay by card, our payment processor handles it. Your card number goes to them, not to us — it never touches our servers. What comes back to us is that a payment succeeded, for how much, with a reference. We never see a full card number, we do not store one, and we keep nothing on file to charge you again.
In plain EnglishEuropean and UK law says we need a specific reason to hold anything about you. This table gives the reason for each thing we do, in the order the law numbers them.
| What we do it for | Basis under GDPR Article 6 | The reasoning |
|---|---|---|
| Taking, packing and shipping your order | Contract — Art. 6(1)(b) | A parcel cannot reach an address we do not have |
| Writing a wholesale quote you asked for | Contract, and steps before a contract — Art. 6(1)(b) | A written quote holds its price for 14 days, so it has to exist for at least that long |
| Answering an email or a phone call | Legitimate interests — Art. 6(1)(f) | Our interest is running a workshop that answers people. Low risk, and you started the conversation |
| Honoring the lifetime restitch guarantee | Contract, and legitimate interests — Art. 6(1)(b) and (f) | The guarantee has no time limit and follows the strap to a second owner, so the record has to outlive the sale |
| Spotting fraud and chargeback abuse | Legitimate interests — Art. 6(1)(f) | Our interest is not being defrauded. No automated scoring, no profiling, just a person noticing |
| Keeping tax, accounting and sales records | Legal obligation — Art. 6(1)(c) | US federal and Georgia record-keeping rules want books that back up the numbers |
| Anything optional you say yes to | Consent — Art. 6(1)(a) | You can withdraw it whenever you like, and withdrawing does not undo what was lawful before |
We lean on legitimate interests only where we have weighed your side of it and cannot see the harm in answering a message you sent us. If you disagree with that balance, 11.0 tells you how to object, and objecting costs you nothing.
By category rather than by brand name, because a role we can stand behind outlasts a supplier we might change.
| Who | What reaches them | Why |
|---|---|---|
| Our payment processor | Your card details, which go straight to them, plus the amount and a reference | To take the payment. The card number never passes through us |
| The carrier | Name, delivery address, and a phone number or email for delivery notices | To put the parcel in your hands |
| Our email provider | Whatever is in the message, because that is where the message lives | To run the inbox |
| Our hosting provider | Connection data from serving the pages, which stays on their side of the line | To serve the website |
| Our accountant | Order and payment records, invoices, the books | Tax returns and annual accounts |
| Termly, the consent manager | Your cookie choice and the consent record tied to it | To remember what you answered, and to keep the proof that we asked |
| tawk.to, the live-chat provider, and its subprocessors | Only if you switch the chat on: your messages and submitted details, IP address, browser and device data, pages and session activity, approximate location, timestamps | To run the chat and support you on it. Blocked until you opt in |
| A court, regulator or law enforcement | Only what a lawful order actually compels, and no more | Because we have to. We will tell you it happened unless we are legally barred from telling you |
| A buyer of the business | Whatever is in the records at that point | Only if Gearhold is ever sold or merged. Not planned, not in progress, and this policy would have to travel with the records |
That is the whole list. We do not sell personal information and never have. We do not share it for cross-context behavioral advertising. We run no ad trackers, no data brokers and no affiliate pixels, and there is no advertising identifier here to hand anyone even if we wanted to.
Two kinds of data cross a border in this business, and they are worth separating because only one of them is avoidable.
On the legal machinery: there is an adequacy route for US companies certified under the EU–US Data Privacy Framework and its UK extension. We are not certified under it, so we do not claim it. We hold no standard contractual clauses with our own suppliers and no transfer impact assessment. What we do instead is hold as little as possible, for as short a time as the guarantee and the tax rules allow. If that is not an acceptable trade, do not send us the order — we would rather lose the sale than mislead you about it.
| Record | How long | Why that long |
|---|---|---|
| Order, invoice and payment records | Seven years from the end of the tax year | Our working practice, set to cover US and Georgia record-keeping comfortably. Treat it as our rule, not as a citation |
| Wholesale quotes you asked for | Two years from the date we sent it, longer if it turned into an order | A quote holds its price for 14 days, but shops come back a season later and we would rather find the old one |
| Email correspondence | Two years from the last message in the thread, then deleted | Long enough to remember the conversation, short enough not to become a library |
| Guarantee and repair records | Indefinitely, in the shortest useful form | The restitch guarantee has no time limit and follows the strap to a second owner, so the record has to outlive the sale |
| Notes from a phone call | Deleted once the thing they were about is finished | They are notes on a bench, not a database |
| Anything entered into the quote form on the site | Not applicable | It never reached us. See 3.0 |
| Chat transcripts | Held in the tawk.to dashboard for as long as our settings there keep them; a deletion request to us is actioned there or passed on | The provider runs the chat, so the record lives in their system rather than ours |
Where a record has to stay for tax, we cut it back to what the tax rule needs: who bought, what, when, for how much. The conversation around it goes.
In plain EnglishYou can ask what we hold, have it corrected, have it deleted, take a copy elsewhere, or tell us to stop. It is free, we do not ask why, and it is one email.
If the GDPR or the UK GDPR applies to you, these are yours by right. We honor them for anyone who asks, wherever they live, because running two standards would take more effort than running one good one.
There is no automated decision-making here and no profiling. Nothing about your order, your price or your guarantee claim is decided by a machine.
To use any of them, email hello@fixedgearstraps.com saying what you want, call +1 (762) 760-1179 during Tue–Sat 10–18 ET, or post the request to the address in 16.0. It is free and we do not ask your reasons. We answer within one month. If a request is genuinely complicated we will tell you inside that month and may take up to two further months, which is the limit the law sets.
We may ask a question or two first, to be sure we are handing your data to you rather than to someone who knows your name. Writing from the address we already have on file usually settles it.
The step-by-step, including what to put in the message so we can act on it straight away, is at /legal/your-data.
In plain EnglishCalifornians get a specific list of rights with its own vocabulary. We do not sell or share your data, so parts of the list have nothing to bite on — but here is the whole thing anyway.
If you are a California resident, the CCPA as amended by the CPRA gives you the rights set out below. It uses statutory categories, so this section uses them too. The table covers the twelve months before the effective date at the top of this page.
| Statutory category | Collected? | What it means here |
|---|---|---|
| A. Identifiers | Yes | Name, postal address, email address, and a phone number if you gave one |
| B. Customer records (Cal. Civ. Code 1798.80(e)) | Yes | Name and address tied to a purchase, and the fact that a payment was made |
| C. Protected classification characteristics | No | Race, color, religion, age, sex, disability and the rest of the protected list. We do not ask and we have no use for it |
| D. Commercial information | Yes | What you ordered or asked us to quote: products, quantities, colorways, order history |
| E. Biometric information | No | We have no use for it and no way to collect it |
| F. Internet or other electronic network activity | Only if you switch the chat on | The chat widget, tawk.to, processes the pages you view and your session activity while it is active. It is blocked until you opt in, and we build no analytics on anything |
| G. Geolocation data | No | We know the address you asked us to ship to. That is a delivery address, not location tracking |
| H. Audio, electronic, visual or similar sensory information | No | We do not record calls |
| I. Professional or employment-related information | Yes, for wholesale only | Shop or team name and buyer type, when you ask for a trade price |
| J. Education information | No | We have never asked and would not know what to do with it |
| K. Inferences drawn to create a profile | No | We draw none. There is no profile to draw them into |
| Sensitive personal information (Cal. Civ. Code 1798.140(ae)) | No | No government IDs, no account credentials, no precise geolocation, nothing about race, religion, union membership, health, sex life or sexual orientation |
The source of all of it is you — what you wrote, said, or typed into a chat — plus the session data the chat widget itself processes if you switch it on. The purposes are filling your order, answering your message, honoring the guarantee, running the chat you asked for and keeping the books. It is disclosed for those business purposes to the categories of recipient listed in 8.0, and to nobody else. How long each kind of record stays is set out in 10.0.
On opt-out preference signals: a browser can send a Global Privacy Control signal, and some send a Do Not Track header. We do not act on either, for the same reason there is no opt-out link. There is no sale, no sharing and no tracking here for a signal to switch off. We do not read those headers and we would not change our behavior if we did, because the behavior they ask for is already the behavior.
Three ways to submit a request: email hello@fixedgearstraps.com, call +1 (762) 760-1179 during Tue–Sat 10–18 ET, or post it to Gearhold LLC, 104 S Cherry St, Tunnel Hill, GA 30755, USA. We confirm receipt within 10 business days and answer within 45 days. If we need longer we will say so inside those 45 days and take up to 45 more, which is what the law allows.
An authorized agent can make a request for you. Send written permission signed by you, and we will still check with you directly before handing anything over.
We do not knowingly sell or share the personal information of anyone under 16, for the same reason we do not sell or share anyone else.
Other states have written their own versions since — Virginia, Colorado, Connecticut, Texas, Oregon, Montana and a lengthening list behind them. Most only bite on businesses far larger than this one, and we are almost certainly under every threshold they set. It makes no difference here. Ask by any of the three routes above and you get the same answer on the same clock as everyone else. Nobody should have to work out which statute they live under before we will talk to them.
This site is not directed to children under 13. We do not knowingly collect anything from them. There is no account to create, no form that transmits, and nothing on the site that asks an age. Straps are hardware for a bike, and the buying is done by adults.
If you are a parent or guardian and you think a child has sent us something, email hello@fixedgearstraps.com or call +1 (762) 760-1179. We will find it, delete it, and tell you what there was and that it is gone. No court order needed, no form to fill in. Just ask.
The short version is that holding less is the security policy. There is no customer database to breach, no accounts to compromise, no card numbers on our side and no analytics store sitting there full of behavior. What exists is an inbox, an order file and a set of books.
Access to those stays with the people who run the workshop. Card handling stays with our payment processor and never crosses to us. The fuller account — what we do, what we deliberately do not do, and how to tell us if you find something wrong — is at /legal/trust-security.
What we do not have, said plainly so nobody has to guess: no SOC 2 report, no ISO 27001 certificate, no PCI-DSS attestation of our own, no penetration test, no bug bounty, no security team and no cyber insurance. A workshop this size does not have those, and we are not going to imply otherwise.
No arrangement is perfect. If a breach ever touches your personal data we will tell you without undue delay — what happened, what was in it, what to do about it. Where the GDPR or the UK GDPR applies we notify the supervisory authority within 72 hours of becoming aware of it; we have no establishment in the EU and no lead authority, so that means the authority for the people affected rather than one regulator standing in for the rest. Where a US state breach law applies we follow that one, including the Georgia rules for Georgia residents. You will hear it early with an incomplete picture rather than late with a tidy one.
If you have found something broken on the site, write to hello@fixedgearstraps.com. We will thank you for it, not threaten you over it.
When this changes, the effective date at the top of the page changes with it, and the current version is always the one sitting at /legal/privacy. For anything material — a new category of data, a new kind of recipient, a new purpose — we will say what changed and when, in a short dated note on this page.
20 Aug 2026: the site added a consent manager (Termly) and an optional live-chat widget (tawk.to), and sections 1.0, 2.0, 4.0, 5.0, 6.0, 8.0, 9.0, 10.0 and 12.0 were updated to describe them. Nothing else about what we hold, why we hold it or how long we keep it changed.
We cannot email you about it. There is no mailing list, no accounts and no subscriber file — which is the whole point of the rest of this document, and the one place that choice costs you something. If a change matters to you, check the date at the top now and then, or ask us.
We keep the previous wording. If you want to know what a clause said on the day you ordered, ask and we will tell you.
Gearhold LLC, 104 S Cherry St, Tunnel Hill, GA 30755, USA. A letter reaches the same bench as everything else.
Those two addresses are the only two we have. There is no privacy inbox, no legal inbox and no dpo inbox to write to. If mail arrives from an address like that claiming to be us, it is not us.
If you are in the EEA or the UK and you think we have got any of this wrong, you can complain to your own supervisory authority without coming to us first. We would rather start with a phone call and fix it, but it is your right and we will not make it awkward.